goodboy-framework - 15-stage Windows malware development & analysis co

项目说明

Goodboy Framework

A 15-stage progressi malware de & analysis course written in Rust. Every technique taught from both red team (offense) and blue team (defense) perspectives. All 15 binaries achieved 0/76 on .

---

What This Is

A hands-on course that takes you from "what is a shellcode loader" to "build a full C2 agent" — with empirical AV/ML e data at every step.

Each stage adds one new offensi on top of the previous. Each Learning Path documents:

This is not theory. Every binary was tested against 76+ A. Every detection claim has a VT hash to prove it.

---

The 15 Stages

| Stage | Technique | What You'll Learn | Lines | Status |
|-------|-----------|-------------------|-------|--------|
| 01 | Basic Loader | XOR decrypt, PEB-walk API hashing, >>CreateThread, anti-sandbox, YARA/Sigma rules | 1,649 | Released |
| 02 | XOR Cryptanalysis | Known-plaintext attack, Index of Coincidence, entropy classification, memory scrubbing, Paradox | 1,237 | Released |
| 03 | AES + Jigsaw | RC4 stream cipher, entropy normalization fragmentation, nonce/integrity , multi-scale entropy detection | 1,492 | Released |
| 04 | API Hashing | Additive hash deep di resolution (kernel32+user32+ntdll), rainbow tables, gs:[0x60] detection in | 1,085 | Released |
| 05 | APC Injection | Early Bird APC, cross-process execution, remote-side decryption, decoder stub, triple encryption | 1,133 | Released |
| 06 | Analysis | Same technique different keys, family clustering, cross- YARA, in detection | 1,191 | Released |
| 07 | Direct Syscalls | SSN resolution, inline syscall instruction, hook bypass, call stack forensics, e trade-off | 883 | Released |
| 08 | Indirect Syscalls | Gadget scanning, CALL-based indirection, call stack e, zero syscall in .text | 783 | Released |
| 09 | Anti-Debug | 7 techniques: PEB×2, NtQIP×3, RDTSC timing, hardware breakpoints, e paradox | 766 | Released |
| 10 | Anti-Sandbox | Hardware fingerprinting, weighted scoring, CFG-safe sandbox detection, dual anti-analysis | 1,008 | Released |
| 11 | Persistence | Registry Run key, path obfuscation, direct IAT imports, set-execute-cleanup lifecycle | 1,144 | Released |
| 12 | Module Stomping | O DLL .text at entry point, CFG-valid execution, inline PE parsing, pe-sie | 1,230 | Released |
| 13 | Sleep Obfuscation | XOR encrypt during sleep, RX↔RW cycling, 95% scanner miss rate | 1,254 | Released |
| 14 | Combined Loader | 7-phase attack chain, MBA XOR key deri, module stomping with 4-DLL fallback, user interaction trigger | 1,176 | Released |
| 15 | C2 Agent | Full C2 with encrypted HTTP beaconing, browser-gate, 0/71 VT, 2,152-line LP with 18 sections, 20 exercises, APT parallels, IR playbook | 2,152 | Released |

---

How Each Stage Works

Every stage folder contains:

| File | What It Is |
|------|------------|
| *.exe | The compiled binary (~280-300 KB, Rust, PE64) — open in Ghidra/x64dbg |
| README.md | Quick start guide, technical details, gate architecture |
| LEARNING_PATH.md | The main content — 700-1,600 lines of guided analysis with theory, exercises, Python scripts, detection rules, and ad challenges |

No source code is included. You re the binary using the Learning Path as your guide — the same way you'd analyze real malware.

---

Quick Start

1. Set up a Windows 10/11 x64 VM (FlareVM recommended)
2. Install tools: Ghidra 11.x, x64dbg + ScyllaHide, Python 3.10+, PE-bear
3. Start with Stage 01 — open the Learning Path and follow along
4. Work sequentially — each stage builds on concepts from the previous one

(required for sandbox detection gates to pass):

---

What Makes This Different

Dual Perspective

Every technique is taught from both sides. You don't just learn to build a loader — you learn to detect it, then learn to break your own detection.

Empirical E Data

This isn't "my AV didn't flag it." Every binary was submitted to and tested against all 76 engines. The Learning Paths document:

Production-Grade Code

The binaries are compiled Rust (not toy C demos), with:

---

The Arms Race

Every stage exists because a defender broke the previous one.

---

Sample Burning — The Hidden Lesson

The most important lesson in this course isn't a technique — it's an operational reality:

> The act of testing IS the burn. Every submission feeds the sample to 76+ A. They use YOUR submissions to train their ML classifiers. You can't check if your binary is clean without making it dirty.

Stage 03 was the canary that re this. It achieved 0/76, then ESET created Agent.ION specifically from the submission data between March 1-9, 2026. The binary hadn't changed — but the AV had learned from it. This pattern then repeated across all 15 stages.

The Learning Paths document the full forensic timeline of each binary's .

---

Course Statistics

| Metric | Value |
|--------|-------|
| Stages | 15 (all released) |
| Total learning content | 19,500+ lines |
| Exercises | 80+ hands-on |
| YARA rules | 20+ (with ad countermeasures) |
| Sigma rules | 11+ (beha + Sysmon detection) |
| Python scripts | 28+ (solvers, scanners, crypto tools, mock C2) |
| A tested | 76 |
| Languages | Rust (binaries), Python (tooling) |
| Platform | Windows x64 |

---

Safety

> EDUCATIONAL USE ONLY

This material is for authorized security training, research, penetration testing, and CTF competitions. Not for unauthorized access or operational deployment against systems without explicit written permission.

---

Requirements

| Tool | Purpose | Link |
|------|---------|------|
| Windows 10/11 x64 VM | Execution en | FlareVM |
| Ghidra 11.x | Static analysis | ghidra-sre.org |
| x64dbg + ScyllaHide | Dynamic analysis | x64dbg.com |
| Python 3.10+ | Scripts and solvers | python.org |
| PE-bear | PE structure | GitHub |

---

Author

Built with Rust 1.93.1 MSVC | Tested against 76+ A | March 2026

项目信息

开发语言：未知

Star 数：299

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕15-stage Windows malware development & analysis course in Rust. Red team builds it, blue team detects it. All 15 binaries achieved 0/76 on VirusTotal.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。